OAuth logout #61

Author: picman

app/controllers/redmine_oauth_controller.rb

@@ -159,10 +159,12 @@ def oauth_callback
     # Try to log in
     set_params
     try_to_login email, user_info
+    set_oauth_login_cookie true, request
   rescue StandardError => e
     Rails.logger.error e.message
     flash['error'] = e.message
     cookies.delete :oauth_autologin
+    cookies.delete :oauth_login
     redirect_to signin_path
   end
 
@@ -178,6 +180,18 @@ def set_oauth_autologin_cookie(value, request)
     cookies[:oauth_autologin] = cookie_options
   end
 
+  def set_oauth_login_cookie(value, request)
+    cookie_options = {
+      value: value,
+      expires: 1.year.from_now,
+      path: RedmineApp::Application.config.relative_url_root || '/',
+      same_site: :lax,
+      secure: request.ssl?,
+      httponly: true
+    }
+    cookies[:oauth_login] = cookie_options
+  end
+
   private
 
   def set_params

lib/redmine_oauth/patches/account_controller_patch.rb

@@ -33,8 +33,10 @@ def login
 
       def logout
         delete_oauth_autologin_cookie
-        return super if User.current.anonymous? || !request.post? || Setting.plugin_redmine_oauth[:oauth_logout].blank?
+        return super if User.current.anonymous? || !request.post? ||
+                        Setting.plugin_redmine_oauth[:oauth_logout].blank? || oauth_login_cookie.blank?
 
+        delete_oauth_login_cookie
         site = Setting.plugin_redmine_oauth[:site]&.chomp('/')
         id = Setting.plugin_redmine_oauth[:client_id]
         url = signout_url
@@ -72,9 +74,17 @@ def delete_oauth_autologin_cookie
         cookies.delete :oauth_autologin
       end
 
+      def delete_oauth_login_cookie
+        cookies.delete :oauth_login
+      end
+
       def oauth_autologin_cookie
         cookies[:oauth_autologin]
       end
+
+      def oauth_login_cookie
+        cookies[:oauth_login]
+      end
     end
   end
 end